             auth-exts)))
 
 (defn seq-contains? [coll target] (some #(= target %) coll))
+
+;; Writing various SSL objects safely
+;; These versions all encode writing atomically and knowledge of file permissions
+
+(schema/defn write-public-key
+  "Encode a key to PEM format and write it to a file atomically and with
+  appropriate permissions for a public key."
+  [key :- PublicKey
+   path :- schema/Str]
+  (ks-file/atomic-write path (partial utils/key->pem! key) public-key-perms))
+
+(schema/defn write-private-key
+  "Encode a key to PEM format and write it to a file atomically and with
+  appropriate permissions for a private key."
+  [key :- PrivateKey
+   path :- schema/Str]
+  (ks-file/atomic-write path (partial utils/key->pem! key) private-key-perms))
+
+(schema/defn write-cert
+  "Encode a certificate to PEM format and write it to a file atomically and with
+  appropriate permissions."
+  [cert :- Certificate
+   path :- schema/Str]
+  (ks-file/atomic-write path (partial utils/cert->pem! cert) public-key-perms))
+
+(schema/defn write-crl
+  "Encode a CRL to PEM format and write it to a file atomically and with
+  appropriate permissions."
+  [crl :- CertificateRevocationList
+   path :- schema/Str]
+  (ks-file/atomic-write path (partial utils/crl->pem! crl) public-key-perms))
+
+(schema/defn write-crls
+  "Encode a list of CRLS to PEM format and write it to a file atomically and
+  with appropriate permissions."
+  [crls :- [CertificateRevocationList]
+   path :- schema/Str]
+  (ks-file/atomic-write path (partial utils/objs->pem! crls) public-key-perms))
+
+(schema/defn write-csr
+  "Encode a CSR to PEM format and write it to a file atomically and with
+  appropriate permissions."
+  [csr :- CertificateRequest
+   path :- schema/Str]
+  (ks-file/atomic-write path (partial utils/obj->pem! csr) public-key-perms))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;; Serial number functions + lock

                                      private-key
                                      public-key)]
    (write-cert-to-inventory! cacert (:cert-inventory ca-settings))
    (ks-file/atomic-write (:capub ca-settings) (partial utils/key->pem! public-key) public-key-perms)
    (ks-file/atomic-write (:cakey ca-settings) (partial utils/key->pem! private-key) private-key-perms)
    (ks-file/atomic-write (:cacert ca-settings) (partial utils/cert->pem! cacert) public-key-perms)
    (ks-file/atomic-write (:cacrl ca-settings) (partial utils/crl->pem! cacrl) public-key-perms)
    (ks-file/atomic-write (:infra-crl-path ca-settings) (partial utils/crl->pem! infra-crl) public-key-perms)))

(schema/defn split-hostnames :- (schema/maybe [schema/Str])
  "Given a comma-separated list of hostnames, return a list of the

                                             (.getPublicKey cacert)))]
    (log/info (i18n/trs "Signed certificate request for {0}" subject))
    (write-cert-to-inventory! signed-cert cert-inventory)
    (write-cert signed-cert (path-to-cert signeddir subject))))

(schema/defn ^:always-validate
  save-certificate-request!
